Pass command flags down from resolve-audit to nested npm audit fix

[jpicton]

G'day,

When using resolve-audit to resolve vulnerabilities by applying an autofix, my team has been running into an issue where CLI flags aren't passed along to the nested npm audit fix command. As an example, here is the process we use:

CI Build:
Execute check-audit --omit dev --registry CUSTOM_REPO_URL--json > audit-report.json

When the CI build fails at this step, a developer will come along and seek to resolve it by:

1. Executing resolve-audit --omit dev --registry CUSTOM_REPO_URL
2. Selecting to "fix" the issue
3. npm audit fix is then executed (note the flags have been dropped)
4. This command fails because the registry can't be found
5. Developer then has to manually run npm audit fix --omit dev --registry CUSTOM_REPO_URL
6. Developer manually adds entry to audit-resolve.json to state that resolution decision was "fix" (with associated timestamp)

I'm unsure whether this is expected behaviour, but these last two manual steps do become frustrating when you have to repeat them regularly. Is it possible to pass any CLI flags provided to the original resolve-audit call down to the nested npm audit fix?

[naugtur]

Thanks for reporting.
I don't think all flags can be transparently passed on to the fix command, so we'd need a shortlist of those that are, if present.

My intention with the latest major version was to leave the fix command out as it's been proving less capable over time. I encourage you run the fix before resolve-audit and then supplement the fixes manually if needed, after which you run resolve-audit.
Since npm v7 there's no longer a way to fix individual packages, so the ability to mark them as fixed automatically is mostly gone.

Let me know if you think it makes sense to make --registry pass through to the fix command or you'd be better off running audit fix separately.

[jpicton]

Apologies for not following up earlier. Thanks for the explanation. I'll amend our process to run the fix command prior to the reolve-audit command. I think the only caveat here is that you lose your history of "fix" decisions in audit-resolve.json, but perhaps this isn't a huge deal.